Description

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users who are not builders or administrators. This issue is fixed in version 3.39.25.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T19:17:55.723Z",
  "pubdate": "2026-08-12T19:17:55.723Z",
  "executiveSummary": "An access control vulnerability exists in the Budibase low-code platform prior to version 3.39.25, specifically within the global groups API endpoint. The vulnerability arises from an omission of the auth.builderOrAdmin middleware on the GET /api/global/groups endpoint located in packages/worker/src/api/routes/global/groups.ts. This authorization flaw allows an authenticated user assigned a restricted BASIC role to successfully query and enumerate sensitive tenant information. The exposed data includes tenant groups, role mappings, user memberships, builder permissions, and default-group flags. Consequently, low-privilege users can harvest internal security configurations and access-control structures that should strictly be restricted to builders and administrators. The risk implication involves severe information disclosure regarding the authorization architecture of the multi-tenant environment, facilitating further targeted attacks against the application. Successful exploitation requires network access to the API and a valid low-privilege BASIC role authentication token, but does not necessitate prior builder or administrative privileges.",
  "technicalDetails": "The vulnerability is rooted in a missing function-level access control check within the routing logic of the Budibase worker package. Specifically, the GET /api/global/groups endpoint defined in packages/worker/src/api/routes/global/groups.ts fails to enforce the required auth.builderOrAdmin security middleware. In properly secured routes within the application, this middleware validates that the requesting user possesses administrative or builder privileges before fulfilling the request. Because this validation is absent on the affected endpoint, the application relies solely on basic session authentication rather than role-based authorization.\nThe attack flow proceeds as follows: an attacker with standard credentials associated with a restricted BASIC role initiates an HTTP GET request to the /api/global/groups endpoint. Upon receiving the request, the server processes it without verifying whether the authenticated user holds the necessary administrative role. The controller queries the underlying database or data store for global group configurations and serializes the resulting data structure into the HTTP response. The returned payload contains comprehensive authorization metadata, including tenant groups, role mappings, user memberships, specific builder permissions, and default-group flags.\nThe affected component is the global groups routing module in Budibase versions prior to 3.39.25. The attack vector is network-based via HTTP/HTTPS protocols targeting the platform's REST API. The prerequisite for exploitation is a valid user session with a low-privilege BASIC role. The post-exploitation impact includes unauthorized information disclosure, mapping of the tenant access-control structure, identification of administrative users, and potential reconnaissance to identify high-value targets for privilege escalation or lateral movement within the Budibase deployment."
}